Business-Driven, Compliant Identity Management

Transcription

1 Solution in Detail NetWeaver NetWeaver Identity Business-Driven, Compliant Identity Using NetWeaver Identity Managing users in heterogeneous IT landscapes presents many challenges for organizations. System landscapes are more complex than ever, and user tasks and responsibilities are constantly evolving. This complexity is compounded by regulatory requirements mandating that organizations track who had access to which applications at what time. With the NetWeaver Identity component, you can integrate identity management with the business processes within and beyond your enterprise, using identity federation to facilitate joint authentication and single sign-on solutions for a secure identity management solution across company boundaries.

2

3 CONTENT 4 Business Challenges 4 Identity for the User Lifecycle 5 The Solution 5 Supporting a Heterogeneous Landscape 5 Providing Business-Driven Identity 8 Identity Federation and Single Sign-On 9 Features and Functions 11 The Benefits 11 For More Information 12 Quick Facts

4 Business Challenges Managing Costs, Process Change, and Compliance Identity management solutions address several key business challenges. High operational costs and risks Complex system landscapes require that your IT department maintain multiple sources of identity data, entering data for each user as well as assigning permissions in multiple systems. Having to provision users in multiple systems translates into delays in making new employees productive. It also presents risks when employees who have changed roles or have left the organization continue to have access longer than they should. Paper-based approval processes further complicate this process, and users are dependent on help desk staff for password resets and changes in access or permissions. Changing business consumption models In today s complex business environment, organizations are increasingly interconnected. Business processes are extended across corporate boundaries with participants from multiple organizations, including partners and customers. As new consumption models are introduced in this context in response to competitive pressures, managing access to the applications by participants from within as well as across enterprise boundaries becomes a challenge. Increasing compliance requirements One of the key factors driving the adoption of identity management solutions in the past few years is compliance requirements. Laws such as the Sarbanes-Oxley Act, Gramm-Leach- Bliley Act (for financial institutions), and Health Insurance Portability and Accountability Act require that your organization be able to state with certainty who had access to what system resources and when. Identity management solutions help you achieve compliance, provide needed audit trails, and prevent unauthorized access. Identity for the User Lifecycle A comprehensive identity management solution covers the entire lifecycle of a user from the onboarding process of a new employee to the termination of an employment contract. If you don t have an identity management solution, the work required to provision and manage user access in a compliant and auditable way is labor intensive, repetitious, and error prone. This problem is compounded when you consider the typical user lifecycle within an organization. When an employee is hired, your organization gives him or her certain permissions in a variety of systems. Later, the employee may receive a promotion or change roles and so receive new, additional permissions. Furthermore, you may need to grant other temporary privileges for some year-end activity or while an employee is covering for a colleague on vacation. Thus, an employee typically tends to accrue privileges over time and often continues to have access that is no longer required for the current role. This is, of course, a security risk. But it is also a potential compliance violation. Adding a new role might cause conflicting authorizations for the user. Consider this example: A purchasing manager is authorized to issue orders to external vendors for example, to buy office supplies. To step in for a colleague who s on sick leave, this purchasing manager temporarily needs the authorization to create vendors in the system. The employee could now misuse his roles, create a new (fictitious) vendor, and issue an order. To minimize the risk that comes from such segregation of duties violations, a compliance check must be performed for all role assignments that apply to critical business processes, such as enterprise resource planning (ERP) system roles. Finally, when the employee leaves your company, the access that this user has may still not be revoked, perhaps even years later, which presents obvious and ongoing security risks to your organization. At each stage, you need to give the user access to the right set of applications according to his or her current role. The NetWeaver Identity component helps you manage this process centrally, across solutions as well as heterogeneous, non- applications. 4 Solution in Detail Business-Driven, Compliant Identity

5 The Solution How NetWeaver Identity Can Help NetWeaver Identity can help your organization grant and manage user access to heterogeneous applications securely and efficiently, in alignment with your business processes and in accordance with audit and compliance requirements. The solution provides a central mechanism for provisioning users and assigning the appropriate business roles. It also supports related processes such as password management, selfservice, and approvals workflow. NetWeaver Identity takes the pain out of user provisioning by offering: One central place to manage users in and non- applications regardless of the individual data stores (for example, changing a phone number or address automatically updates all relevant systems) Tight integration with your company s business processes Centralized reporting functionality to address the pressing need for compliance and auditability using the NetWeaver Business Warehouse component, mapping of one user to identities in all systems, and fully auditable user access across the entire IT landscape Password-reset and lost-password management functionality for end users, alleviating help-desk workload and reducing operational costs Built-in identity federation functionality for cross-company identity management scenarios and single sign-on Integration with NetWeaver Single Sign-On software to support end-to-end single sign-on and encryption in distributed environments, including all graphical user interfaces (GUIs) as well as Web-based front ends Supporting a Heterogeneous Landscape NetWeaver Identity enables you to streamline provisioning of users into all applications and third-party as well as operating systems, file systems, and databases via a comprehensive, constantly expanding connector framework (see Figure 1). The integration is based on open communication standards to enable the integration of virtually all applications, including Microsoft Active Directory, Microsoft Exchange, IBM Lotus Notes, and many others. The integration of NetWeaver Business Warehouse allows for highly customized, differentiated state-of-the-art reporting. Business processes Organizational management Role lifecycle management NetWeaver Identity Providing Business-Driven Identity Identity management solutions evolved from the need for IT organizations to efficiently manage users across multiple applications. These solutions were essentially IT efficiency tools that streamlined the process of user management by providing a central mechanism to enable these processes. As organizations achieve these efficiencies and realize the value of these solutions, it is becoming apparent that you can accrue greater benefits. You can gain these benefits by aligning the user management functionalities more closely with the business processes that these users access. NetWeaver Identity is integrated with Business Suite software. This comprehensive support for user provisioning is driven by the Business Suite Other applications Heterogeneous environment Figure 1: Support for Heterogeneous Landscapes in NetWeaver Identity Solution in Detail Business-Driven, Compliant Identity 5

6 business processes implemented by the various applications of Business Suite. For example, integration with the ERP Human Capital solution automates identity management processes on the basis of employee creation and status change events triggered by HR business processes, as shown in Figure 2. However, integration is not limited to employee scenarios. Identity management processes for business partners and students are also supported, such as the automated creation of users and corresponding business partners in the Customer Relationship and Supplier Relationship applications. ERP HCM Calculate entitlements based on position Perform compliance check remediation New hire Approve assignments No NetWeaver Identity offers a convenient but powerful role concept (see Figure 3). Business roles, which are defined as part of a business process, can be assigned to users. These business roles consist of one or more technical roles, which are system specific and represent access information or technical authorizations. These include authorization roles such as those for software systems that are based on the ABAP programming language or groups for Active Directory. By focusing on business processes and business roles, NetWeaver Identity lets you start with business requirements and encapsulate the complexity of managing technical roles and access. When you assign a Yes Customer Relationship ERP NetWeaver Portal Third party Create employee Assign roles Create employee Assign roles Create user Assign roles Update access rights When employees take on additional responsibilities, the assignment of a new role often causes a segregation of duties conflict with existing roles. You can mitigate the risks arising from such constellations by incorporating risk mitigation processes into your role assignment process. ERP Human Capital NetWeaver Identity BusinessObjects Access Control Line manager Figure 2: Integration of HR Processes with Identity Landscape business role to a user, all technical roles for that business role and any role below that it in the hierarchy are assigned to the user. In addition, workflow and provisioning is automatically triggered. 6 Solution in Detail Business-Driven, Compliant Identity

7 By complementing your identity management functionality with a solution for governance, risk, and compliance that manages access control, you can enable compliant identity management (see Figure 4). In other words, you can ensure that roles and authorizations assigned to a user do not contain conflicting rights. You re not only securing the identity management process but also making it completely compliant and auditable. NetWeaver Identity offers compliant user provisioning and full reporting and audit functionalities. By integrating NetWeaver Identity with BusinessObjects governance, risk, and compliance (GRC) solutions, you can prevent segregation of duties violations that can occur when roles with conflicting permissions are assigned to a user and put mitigating controls in place. Your organization can get clean, stay clean, and stay in control of access to all applications in the system landscape, from Business Suite to third-party applications. Business roles Technical roles system Employee Microsoft Active Directory user Microsoft Active Directory End user (Portal role) NetWeaver Portal component Figure 3: Business Roles and Technical Roles Accounting Accounting (Role for users of software based on ABAP programming language) ERP Financials solution Manager HR manager (Role for users of software based on ABAP programming language) ERP Human Capital solution Solution in Detail Business-Driven, Compliant Identity 7

8 NetWeaver CIO Identity Provides reduced total cost of ownership and increased security BusinessObjects Access CFO Control application Helps ensure that IT business application controls are compliant Figure 4: How Business-Driven Compliant Identity Works Identity Federation and Single Sign-On As business processes are no longer confined to corporate boundaries, and IT applications are increasingly moving from on-premise to on-demand or cloud scenarios, identity management is becoming an extremely important factor in a company s security strategy. The concept of identity federation describes the process of authenticating a user across multiple IT systems and organizations. An airline passenger, for example, could be a car rental customer as well. If the airline and the rental car provider have entered into a federation agreement, which means that they have agreed to mutually trust each other s authentication of their customers, customers must only authenticate themselves once. Their authenticated identity can then be transferred from the airline s system to the rental car provider s system or vice versa. Compliant identity management Provides compliant identity management across software and heterogeneous landscapes in one integrated solution Provides standards-based integration to create tightly aligned, loosely coupled solution from complementary components Gives a consistent view of current and historic access rights, approvals, and policy violations Federation is enabled through the use of open industry standards, such as the Security Assertion Markup Language (SAML). NetWeaver Identity contains the complete set of functionality needed to set up a fully integrated and secure identity federation scenario. Both an identity provider that issues SAML assertion tickets, which can be used for authentication in a browser-based federation scenario, and a security token service for Web service environments are included in the identity management solution. Integration with NetWeaver Single Sign-On offers comprehensive single sign-on and encryption across organizational and technical boundaries. NetWeaver Single Sign-On provides state-of-the art technologies for integrating heterogeneous system landscapes into one single sign-on scenario, stretching from GUI front ends to Web-based applications. It protects your communication channels with sophisticated, standards-based encryption technologies and at the same time adds convenience in day-to-day business operations. NetWeaver Identity can help your organization grant and manage user access to heterogeneous applications securely and efficiently. The identity management processes are tightly integrated into your business processes while meeting audit and compliance requirements. The component provides a central mechanism for provisioning users in accordance with their business roles and supports related processes such as password management, self-service, and approvals workflow. 8 Solution in Detail Business-Driven, Compliant Identity

9 Features and Functions What You Can Do with NetWeaver Identity NetWeaver Identity consists of two main components the identity center and the virtual directory server that combine to deliver the functions shown in Figure 5. NetWeaver Identity Password management Roles and entitlements Reporting and auditing Provisioning, workflow, and approvals Identity virtualization Data synchronization Figure 5: Components of NetWeaver Identity The main functions of NetWeaver Identity include: Business-driven identity management processes Tightly integrated into your Business Suite applications, NetWeaver Identity offers a one-step approach to user administration for your entire and non- software landscape. Reporting and auditing Critical for compliance, extensive auditing functionality enables you to produce reports based on current access and past events. If questions come up, reports can conclusively state whether the person in question had entitlements to particular applications and associated features and functions. You can transparently maintain all changes to data, user access rights, and administrative permissions. Tight integration with the BusinessObjects Access Control application, an BusinessObjects GRC solution, allows for the effective mitigation of segregation of duties risks and a fully compliant user provisioning process. By integrating NetWeaver Identity with BusinessObjects governance, risk, and compliance solutions, you can prevent segregation of duties violations and put in place mitigating controls. Provisioning, workflow, and approvals Business rules and policies drive assignment and maintenance of user access rights across multiple systems. You can quickly provision employees as well as business partners, and all changes and approvals are fully auditable. Identity virtualization NetWeaver Identity provides an integrated, unified view of the virtual identity of users, as well as identity services to let you leverage identity information and access rights across networks. Password management and employee self-service The software supports self-service password reset and password synchronization across all connected target systems, as well as the ability to perform self-service updates of personal information. These functions reduce the cost incurred by your help desk in servicing password resets. Roles and entitlements Roles align with business processes rather than technical directory structures. Users are assigned roles and given certain privileges, called entitlements, that enable access to various systems. Identity federation Standards-based support for identity federation scenarios helps ensure convenient and secure interenterprise identity management. Integration with NetWeaver Single Sign-On enables comprehensive, standards-based single sign-on and encryption of communication channels across the enterprise. Solution in Detail Business-Driven, Compliant Identity 9

10 Migrating from CUA to NetWeaver Identity Do you use the central user administration (CUA) tool to manage users across multiple software systems that are based on the ABAP programming language? Moving to the NetWeaver Identity component from CUA provides the following advantages: Supports all relevant systems, including and third-party software Supports sophisticated business roles definition and management Provides self-service password resets, removing the biggest headache for help desk staff Enables workflow-based requests for approvals, automating user provisioning in multiple back-end systems Supports standards such as Lightweight Directory Access Protocol (LDAP), Service Provisioning Markup Language (SPML), and Directory Service Markup Language (DSML) Furthermore, migration from CUA is intuitive. As shown in Figure 6, you install NetWeaver Identity on top of CUA. Start connecting applications programmed in ABAP to NetWeaver Identity and disconnecting them from CUA. After you disconnect the last application from CUA, the migration is complete. NetWeaver Identity Desktop Desktop Desktop CUA CUA NetWeaver Identity NetWeaver Portal ERP Supply Chain ( SCM) NetWeaver Portal ERP SCM NetWeaver Portal ERP Microsoft Active Directory Manage CUA from NetWeaver Identity Migrate applications programmed in the ABAP programming language from CUA to NetWeaver Identity Shut down CUA when all applications are migrated Figure 6: Migration from CUA to NetWeaver Identity 10 Solution in Detail Business-Driven, Compliant Identity

11 The Benefits Taking Identity to the Next Level NetWeaver Identity takes identity management from the technical level to the business level. This business-oriented solution lifts identity management by focusing on managing the lifecycle of employees, partners, and customers rather than on technical account management; it moves the management responsibility from IT administrators to business process owners. With identity federation and single sign-on functionality, NetWeaver Identity helps you take identity management to the next level and secure on-demand and cloud applications. Tight integration with NetWeaver Single Sign-On enables a seamless user experience, enhancing security across your system landscape. As organizations continue to allow more and more employees, customers, and business partners access to information and processes across their system landscapes, the need for advanced and flexible single sign-on across the enterprise becomes increasingly important. Leading organizations are also seeking to standardize and centralize security management to improve the overall security of their applications and to decrease costs. These factors reveal the need for centralized authentication, authorization, auditing, and single sign-on experience across all applications. NetWeaver Single Sign-On provides support for many authentication systems including passwords, tokens, X.509 certificates, and smart cards. (See Figure 7.) NetWeaver Identity also lets you emphasize compliance by providing full audit and reporting functionalities and integrating with BusinessObjects GRC solutions in preventing segregation of duties violations. Most important, NetWeaver Identity supports software as well as the full heterogeneous landscape, including Lightweight Directory Access Protocol (LDAP) directories, third-party business applications, operating systems, systems, and databases. You can integrate NetWeaver Identity across the entire system landscape and beyond, into the larger business network. By lowering total cost of ownership and increasing operational efficiency, NetWeaver Identity helps meet your organization s objectives of lower cost, higher productivity, compliance, and auditability. For More Information For more information about how NetWeaver Identity can help your organization, call your representative today or visit us on the Web at /netweaver/components/idm /index.epx. NetWeaver Identity Compliant identity management and single sign-on Compliance governance Business Object Access Control Identity management NetWeaver Identity Authentication and single sign-on NetWeaver Single Sign-On offers a complete suite of compliance, governance, identity, and single sign-on solutions Figure 7: Support for Compliance, Identity, and Single Sign-On Solution in Detail Business-Driven, Compliant Identity 11

12 Quick facts Summary Identity management is becoming a key challenge as organizations must ensure that users have the right access to applications in a timely manner and that data is secure. The NetWeaver Identity component addresses this challenge by helping you align identity management with your organization s key business processes. Business Challenges Reduce operational costs in complex system landscapes Manage access to applications by participants from within and across enterprise boundaries Comply with local and global regulations Key Features Business-driven identity management Align identity management with your business processes in the ERP Human Capital solution or the Customer Relationship application, for example Compliant identity management Fulfill compliance requirements and minimize segregation of duties (SoD) risks by integrating NetWeaver Identity with the BusinessObjects Access Control application Provisioning, workflow, and approvals Assign and maintain user access rights across multiple systems; provision employees and business partners; audit all changes Password management Provide password self-service functionality and password synchronization across all connected target systems Roles and entitlements Align roles with business processes rather than technical directory structures Reporting and auditing Produce reports based on current access and past events Identity federation and single sign-on Enable cross-enterprise identity management and single sign-on Business Benefits Flexible identity management that lowers costs and increases productivity due to tight integration with your business processes across heterogeneous systems Compliance with regulatory requirements for auditability of access to applications, minimizing SoD risks for your enterprise For More Information To find out how NetWeaver Identity can help your organization, call your representative today or visit us on the Web at (11/05) 2011 AG. All rights reserved., R/3, NetWeaver, Duet, PartnerEdge, ByDesign, BusinessObjects Explorer, StreamWork, and other products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of AG in Germany and other countries. Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects Software Ltd. Business Objects is an company. Sybase and Adaptive Server, ianywhere, Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sybase, Inc. Sybase is an company. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary. These materials are subject to change without notice. These materials are provided by AG and its affiliated companies ( Group ) for informational purposes only, without representation or warranty of any kind, and Group shall not be liable for errors or omissions with respect to the materials. The only warranties for Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.